[jira] [Assigned] (WICKET-6602) AuthenticatedWebApplication login Workflow broken with replaceSession

["Andrea Del Bene (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/WICKET-6602?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Andrea Del Bene reassigned WICKET-6602:
---------------------------------------

    Assignee: Andrea Del Bene

> AuthenticatedWebApplication login Workflow broken with replaceSession
> ---------------------------------------------------------------------
>
>                 Key: WICKET-6602
>                 URL: https://issues.apache.org/jira/browse/WICKET-6602
>             Project: Wicket
>          Issue Type: Bug
>          Components: wicket-core
>    Affects Versions: 8.1.0
>            Reporter: Andreas Müller
>            Assignee: Andrea Del Bene
>            Priority: Major
>
> We've got the following issue when upgrading from Wicket 7 to Wicket 8:
> Using AuthenticatedWebApplication a user will be forwarded to the SignInPage, if he is not logged in. 
>  This is done in {{AuthenticatedWebApplication#onUnauthorizedInstantiation()}} which calls {{AuthenticatedWebApplication#restartResponseAtSignInPage()}} which throws a {{RestartResponseAtInterceptPageException}}.
> During construction of {{RestartResponseAtInterceptPageException}} the original request destination will be written in the Session's MetaData ({{InterceptData#set()}}).
> After a successful Login we're calling {{Component#continueToOriginalDestination()}} / {{RestartResponseAtInterceptPageException#continueToOriginalDestination()}} which reads the previously stored MetaData to redirect the user to his original destination.
> The problem is, that before doing this, we're calling {{Session#replaceSession()}} in our SignInPage to protect against Session fixation. But {{Session#destroy()}} is different in Wicket 8:
> Wicket 7:
> {code:java}
> 	private void destroy()
> 	{
> 		if (getSessionStore() != null)
> 		{
> 			sessionStore.invalidate(RequestCycle.get().getRequest());
> 			sessionStore = null;
> 			id = null;
> 			RequestCycle.get().setMetaData(SESSION_INVALIDATED, false);
> 		}
> 	}{code}
> Wicket 8:
> {code:java}
> 	private void destroy()
> 	{
> 		if (getSessionStore() != null)
> 		{
> 			sessionStore.invalidate(RequestCycle.get().getRequest());
> 			sessionStore = null;
> 			id = null;
> 			RequestCycle.get().setMetaData(SESSION_INVALIDATED, false);
> 			clientInfo = null;
> 			dirty = false;
> 			metaData = null;
> 		}
> 	}{code}
> As you can see, in Wicket 8 {{metaData = null;}} will be called. 
>  This results in {{RestartResponseAtInterceptPageException#continueToOriginalDestination()}} not finding any MetaData and being unable to forward the user to his original destination.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)